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Abstract 

Ice buildup in the compressor section of a commercial 
aircraft gas turbine engine can cause a number of engine 
failures. One of these failure modes is known as engine 
rollback: an uncommanded decrease in thrust accompanied by 
a decrease in fan speed and an increase in turbine temperature. 
This paper describes the development of a model which 
simulates the system level impact of engine icing using the 
Commercial Modular Aero-Propulsion System Simulation 40k 
(C-MAPSS40k). When an ice blockage is added to 
C-MAPSS40k, the control system responds in a manner 
similar to that of an actual engine, and, in cases with severe 
blockage, an engine rollback is observed. Using this capability 
to simulate engine rollback, a proof-of-concept detection 
scheme is developed and tested using only typical engine 
sensors. This paper concludes that the engine control system’s 
limit protection is the proximate cause of iced engine rollback 
and that the controller can detect the buildup of ice particles in 
the compressor section. This work serves as a feasibility study 
for continued research into the detection and mitigation of 
engine rollback using the propulsion control system. 

1.0 Introduction 

Ice crystals have been found to accrete in the core of 
commercial turbofan engines at locations where the 
temperatures are initially above freezing (Ref. 1). This icing 
can lead to many different engine failure modes, including 
compressor surge/stall, combustor flameout, compressor blade 
damage, and engine rollback. While ice shedding is the direct 
cause of most of these failures (Ref. 2), the accretion of ice 
may also be responsible for engine power loss. It was 
determined that in turbofan engines the rollback event is 
caused by ice buildup in the engine’s low pressure 
compressor; additionally, the potential for ice accretion exists 
in the first few stages of the high pressure compressor (Ref. 1). 
Engine rollback has been defined in Reference 1 as an 
uncommanded thrust reduction that is accompanied by a 
gradual decrease in fan shaft speed and an increase in Turbine 
Gas Temperature (TGT). Further, the engine does not respond 
to pilot commanded thrust increases. In cases where the 


engine was then shut-down, it was capable of being restarted 
after the aircraft descended to an altitude of approximately 

10.000 ft. Engines that were not shut down began to operate 
normally at roughly the same altitude. This return to normal 
operation is possible at lower altitudes due to the increased air 
temperatures causing the ice to melt or shed. 

Since the identification of engine icing, over 100 engine 
power loss events have been recorded in both large transport 
airplanes as well as small jet aircraft (Ref. 2). To date, most 
of the work has focused on identifying the mechanism by 
which ice crystal accretion occurs and determining the 
environmental conditions in which engine icing is likely 
(Refs. 1 to 4). The general approach taken by the community 
has been to design an engine that does not accumulate ice in 
these conditions or to avoid getting the airplane into a flight 
condition with High Ice Water Content (HIWC). However, 
complete avoidance is not possible and replacing all 
currently operating engines is not feasible. To this end, 
improving the capability of a current engine to safely handle 
these icing scenarios is critically important. 

The authors believe that an engine control system, 
working either with its own information or in coordination 
with airframe sensors, can detect the accretion of ice in the 
engine core prior to an engine rollback and then alter the 
control logic to mitigate the impact of the blockage. To 
develop these ideas further, it is critical to have an engine 
simulation environment in which one can simulate the impact 
of ice accretion in the engine core and test potential detection 
and mitigation strategies. 

The key features that an engine simulation must have to be 
useful in this effort are: (1) highly accurate compressor surge 
margins, (2) an engine controller that is representative of that 
found on modern commercial gas turbine engines, and 3) a 
modular nature to allow modification of engine components 
and the engine control law as necessary. For these reasons the 
Commercial Modular Aero-Propulsion System Simulation 40k 
(C-MAPSS40k) was selected for use in this investigation. 
C-MAPSS40k is a publicly available, MATLAB/Simulink 
(The Math works, Inc.) based simulation of a generic 

40.000 lbf thrust class, twin spool, high bypass, commercial 
aircraft engine (Ref. 5). The simulation includes a realistic 
engine control system that exceeds applicable sections of the 
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US Code of Federal Regulations (14 CFR 33) while preserving 
the safety and operability of the engine (Ref. 6). As described in 
Reference 6, the control system is comprised of a Power 
Management system and Protection Logic system. The Power 
Management system is responsible for converting the pilot’s 
commanded thrust level into a fuel flow command to the engine 
and then maintaining that thrust level. The Power Management 
system maintains thrust by feeding back either the Engine 
Pressure Ratio (EPR) or the fan speed; for this paper, the engine 
is controlled based on EPR. While all of the simulation results 
shown in this paper are from an EPR controlled engine, the 
same conclusions are drawn for a fan speed controlled engine. 
The Protection Logic system is in place specifically to ensure 
that the engine always operates in a safe state. There is logic in 
place to prevent combustor over-pressurization, combustor 
blowout, compressor surge, and fan and core shaft over-speed 
conditions. By modifying the C-MAPSS40k simulation to 
include ice blockage, we can observe the response of the 
nominal control system and then work to develop control law 
modifications to detect and mitigate the effects of the ice 
accretion. 

Part I of this work (Ref. 7) has focused on developing 
models of engine icing. In Part II, the study takes a systems 
level look at the effect of ice accretion on engine performance. 
In Section 2.0 we will look at how to introduce ice accretion 
into the C-MAPSS40k simulation. A brief discussion of 
current engine control systems is given in Section 3.0. 
Simulation results highlighting the role of the engine 
controller during engine ice accretion are presented in 
Section 4.0. Detection of ice accretion using existing engine 
sensors is discussed in Section 5.0 followed by conclusions 
and future work in Section 6.0. 

2.0 Definitions/Abbreviations 


C-MAPSS40k 

The Commercial Modular Aero- 
Propulsion System Simulation 40k 

EGT 

Exhaust Gas Temperature (deg R) 

EPR 

Engine Pressure Ratio 

Fnet 

Net Thrust (lbf) 

HIWC 

High Ice Water Content 

HPC 

High Pressure Compressor 

ISA 

International Standard 
Atmosphere 

LPC 

Low Pressure Compressor 

PLA 

Power Lever Angle 

TGT 

Turbine Gas Temperature 

Wf 

Mass rate of fuel (lbm/s) 


3.0 Modeling Engine Icing 

C-MAPSS40k is an axial-symmetric, lumped volume model 
where each of the engine components has an input and output 
with the relation governed by maps. The thermodynamic 
models in the simulation are not detailed enough to model the 
accretion of ice crystals on the compressor stator vanes. Thus 
in order to simulate the ice buildup and the associated 
compressor flow changes, the compressor map itself must be 
modified. Part I of this research effort (Ref. 7) conducted a 
detailed study of the thermodynamic events associated with 
ice crystal accretion leading to conclusions about where and 
under what conditions ice buildup in the Low Pressure 
Compressor (LPC) occurs. Based on this data, mean-line flow 
analysis software (COMDES) (Ref. 8) was used to construct 
blocked LPC maps for small operating regions. 

An LPC map which models the effects of a 20 percent 
blockage of the first stator was expanded to cover the entire 
operating envelope to be included in C-MAPSS40k. A 
comparison of the nominal LPC map and the 20 percent 
blocked map is shown in Figure 1. From an engine level 
perspective there are a number of important differences 
between the two maps: (1) there is a large decrease in the 
LPC surge line and (2) as the shaft speed increases the speed 
lines get dramatically steeper. The reduction in surge line 
means that the blocked compressor will be much more likely 
to surge than an unblocked compressor and the nominal 
engine controller limits, which are designed to prevent LPC 



Corrected Flow Rate [Ib^/s] 


Figure 1. — Constant corrected speed lines and surge lines of 
the nominal LPC map (blue) compared with those of the LPC 
map with a 20 percent blockage in Stator 1 (red). 
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surge during decelerations, may not be as effective. The large 
shift of the speed lines to the left means that at a given fan 
shaft speed much less air will move through the compressor 
for a given pressure ratio. By decreasing the core mass flow 
rate, the blockage will force the engine controller to increase 
the fuel flow rate into the combustor to generate enough 
power to produce the desired EPR setpoint. 

While it is possible to replace the LPC map used in 
C-MAPSS40k with the blocked map, running at a steady state 
blockage is not the most important situation. Of greater 
interest is the transient impact of ice accretion in the 
compressor. In order to simulate the accretion the LPC must 
move from using the nominal map to the blocked map. While 
the buildup does not have a linear impact on the compressor 
map, we will initially make this assumption as additional 
blocked compressor maps are not yet available. By beginning 
the simulation on the nominal LPC map and then slowly 
transitioning to the 20 percent blockage map, we can roughly 
simulate the accretion of ice inside the LPC. 

Previous research efforts have found that ice crystal 
accretion in commercial aircraft engines most commonly 
occurs at altitudes from 11,500 to 39,000 ft with a median of 
25,800 ft and with the ambient air significantly warmer than 
standard atmosphere (ISA), most frequently ISA+6 and 
greater (Ref. 1). Therefore, our simulations will occur at a 
cruise condition: 25,000 ft altitude, Mach 0.75, ISA+10, and a 
cruise throttle setting. Figure 2 shows the engine outputs at 
this flight condition for a 10 sec transition from the nominal 
LPC map to the 20 percent map starting at 20 sec into the 
simulation. The choice of 10 sec was made to reduce 
simulation time, the actual growth rate of the ice blockage is 
unknown. The simulation results confirm the earlier stated 
expectations of the interaction between the ice accretion and 
the engine controller. As the mass flow rate through the LPC 
decreases due to the blockage, the controller commands a fuel 
flow rate (Wf) increase in order to maintain a constant EPR. 
The increase in fuel flow rate results in an increase in core 
shaft speed (N c ) and fan shaft speed (N f ) due to increased 
power available at the turbines. Since most of the thrust of a 
high-bypass gas turbine engine is generated by the movement 
of air through the bypass duct, the increase in fan speed results 
in more air moving through the bypass duct and thus higher 
thrust production (F net ). 

While the results meet expectations, there is no evidence of 
an engine rollback event. In fact, using this modeling approach 
there is no evidence of a thrust decrease until the test is 
conducted at the highest altitude, speed, and thrust level the 
engine is capable of. Thus in order to obtain a decrease in thrust 
the LPC map must be extended further than 20 percent 
blockage. Flowever, as we do not have a higher blockage map, 
we must find an alternate method of simulating this behavior. 

By changing the compressor map, the pressure ratio across 
the LPC changes as well as the mass flow rate through the 
compressor. When using the 20 percent blockage map, a 
12 percent steady-state reduction in LPC output pressure 
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Figure 2. — Engine outputs (thrust, fuel flow rate, fan speed, 
and core speed) for a 10 sec transition from nominal LPC 
map to 20 percent blocked LPC map at cruise (25,000 ft, 
Mach 0.75, ISA+10) starting at f = 20 sec. 


occurs. Using this knowledge as a starting point, a pressure 
drop is inserted into the C-MAPSS40k LPC. This pressure 
drop is then linearly increased during the simulation to 
simulate the accretion of the ice crystals. Comparing the 
engine outputs for the compressor map transition and a 
transition from 0 percent pressure drop to 12 percent pressure 
drop shows similar behavior (see Fig. 3). As expected the 
steady state EPR values are identical for both cases. Flowever, 
the modeling differences result in a 2.3 percent difference in 
fuel flow rate. While some of the engine outputs appear to 
have a large deviation, the fan speed error is only 1.0 percent 
and there is a 2.4 percent difference in net thrust. The core 
speed matches extremely well and the turbine gas temperature 
error is 1.6 percent. While this match is not perfect, it does 
result in the same general behavior as using the blocked 
compressor maps. Similar results are found if a flow rate 
blockage is used instead of a pressure drop but with slightly 
higher steady-state error. 

In lieu of additional blocked compressor maps, this pressure 
drop approximation can allow us to extend our study to higher 
blockage levels. While no longer directly connected to a 
blockage percentage, the pressure drop can be increased until 
an engine rollback occurs as shown in Figure 4. When the 
pressure drop is increased to 23 percent the behavior is much 
like that of the 12 percent pressure drop, except that there is a 
slight decrease in thrust shortly after the pressure has 
stabilized. Flowever, once the pressure drop reaches 
26 percent (as shown in Fig. 4) there is a large decrease in 
engine thrust and fan speed along with a large spike in TGT — 
an engine rollback has occurred. 
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Figure 3. — Engine outputs comparing a 10 sec transition from 
nominal LPC map to 20 percent blocked LPC map (dashed) 
to a 0 to 12 percent pressure drop across the LPC (solid) at 
cruise (25,000 ft, Mach 0.75, ISA+1 0) starting at f = 20 sec. 


The other aspect of engine rollback is the fact that a throttle 
increase will not result in a thrust increase. To verify that this 
holds true in C-MAPSS40k, the same 26 percent pressure drop 
used above is again used with a throttle increase from cruise to 
maximum power at 40 sec. The results shown in Figure 5 
show the same thrust decrease and then no thrust response to 
the throttle increase. Examining the fuel flow rate plot it can 
be seen that until approximately 32 sec the actual fuel flow 
rate is nearly the same as that desired by the EPR controller, 
however after that point they diverge. A change in desired fuel 
flow rate can be seen when the burst occurs with no 
corresponding change in the actual fuel flow rate. If we then 
look at the actual and desired EPR, we see that during the 
pressure drop transition the actual EPR deviates from the 
desired by ever increasing amounts until the rollback occurs 
and the EPR sharply decreases. Again, the desired EPR 
increases with the throttle increase, but the actual EPR does 
not change. The pilot is no longer able to command thrust 
increases due to the engine rollback. 

It is apparent that the engine controller is preventing the 
engine from reaching the desired EPR. In order to determine 
what aspect of the control system is limiting the fuel flow rate, 
we start with an overview of a nominal engine controller and 
the C-MAPSS40k controller in specific. 
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Figure 4. — Engine outputs comparing a 10 sec transition from 
0 to 20 percent (solid), 23 percent (dashed), and 26 percent 
(dotted) pressure drop across the LPC at cruise (25,000 ft, 
Mach 0.75, ISA+1 0) starting at f = 20 sec. Engine rollback 
occurs at approximately t = 30 sec. 




Figure 5. — Engine and controller outputs for a 10 sec transition 
from 0 to 26 percent pressure drop across the LPC at cruise 
(25,000 ft, Mach 0.75, ISA+1 0) starting at f = 20 sec. Engine 
rollback occurs at approximately t = 30 sec, followed by a 
PLA burst from 68° to 80° at t = 40 sec. 
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4.0 Engine Control Systems 

A typical commercial aircraft engine control system is 
comprised of two main components as shown in Figure 6 
(Ref. 6). The first is the Power Management controller, which 
is designed to regulate the engine performance at a specified 
power level. Ideally, the pilot would be able to command a 
thrust level; however, thrust is not measurable while in flight 
and so alternate parameters are used — typically either fan 
speed or engine pressure ratio (EPR). Each of these signals is 
directly related to the thrust output and can serve as an 
indicator of the thrust level. The pilot’s throttle position is 
converted to a fan speed or EPR setpoint and maintained there 
with a proportional-integral controller. The throttle command 
used in C-MAPSS40k is referred to as the power lever angle 
(PLA) which ranges from a flight idle setting of 40° to 
maximum power at 80°. 

The other component of the engine control system is the 
Protection Logic whose purpose is to ensure the safe operation 
of the engine. As a primary concern, the engine needs to be 
operated in such a way that no component will fail. This 
means protecting components like turbine disks, rotor blades, 
and combustor casing from exceeding their acceptable stress 
levels. To ensure this, engine pressures and shaft speeds are 
monitored and prevented from exceeding a maximum limit. 
The second aspect to “safe operation” is the prevention of 
compressor surge. Surge occurs when a compressor can no 
longer maintain the necessary pressure ratio, resulting in a 
reversal of flow through the engine, a sudden loss of engine 
thrust, and potentially severe damage to engine components. 
The High Pressure Compressor (HPC) is more likely to surge 
during throttle increases while the Low Pressure Compressor 
(LPC) is more likely to surge during a throttle decrease. 
Unfortunately, there is currently no means to directly measure 
how close the engine is to surging; however, there are a 
number of indirect means to prevent compressor surge 
(Ref. 9). In C-MAPSS40k, HPC surge is prevented by the use 
of an acceleration limit. This limit restricts the fuel flow rate 
in order to prevent the core shaft from accelerating faster than 
a preset limit based on the current core speed. The faster the 
core shaft is spinning the more acceleration is allowed. LPC 
surge on deceleration is prevented by ensuring that the fuel 
flow rate to the engine does not decrease too quickly. The 
specific details of the protection logic implemented in the 
C-MAPSS40k engine controller can be found in Reference 6. 

A challenging aspect of engine control and diagnostics is the 
limited number of sensors installed in the engine. For example, 
there are no temperature sensors in the turbine section of the 
engine due to the extremely high temperatures. Thus instead of 
measuring TGT, a sensor is installed which measures Exhaust 
Gas Temperature (EGT). The EGT will track the TGT but will 
be delayed and the magnitude of temperature swings will be 
smaller. In addition to the EGT sensor, C-MAPSS40k is 
equipped with fan speed, core speed, four pressure, and three 
other temperature sensors (Ref. 5). 


Power Management j 



Figure 6. — Diagram of the C-MAPSS40k engine control system 
with throttle (PLA) input and fuel flow rate command output. 
The Power Management and Protection Logic subsystems 
are highlighted. 

Further complicating the lack of sensors is the lack of 
actuators available to modify the engine behavior. 
C-MAPSS40k is equipped with three actuators: a fuel metering 
valve, a set of variable stator vanes (inlet guide vanes) at the 
entrance to the HPC, and a variable sized bleed valve between 
the two compressors. Under nominal conditions, the fuel flow 
rate is actively controlled while the stator vanes and bleed valve 
are scheduled based on sensed engine conditions. However, in 
abnormal situations it is possible to move the actuators off of 
their nominal schedule to alter engine behavior. 

5.0 Engine Control During Icing 

It is clear that the Protection Logic component of the engine 
control system is preventing the fuel flow rate from being high 
enough to achieve the target EPR during engine icing. To 
highlight this fact a test comparing the effect of disabling the 
control limiters is shown in Figure 7. The maximum core 
speed limit (12,200 rpm) is shown on the core speed plot and 
it is apparent that this limit prevents the fuel flow rate from 
increasing and driving the core speed over its limit. When the 
limits are removed, the engine is able to reach a new steady- 
state point with the ice accretion (albeit at a significantly 
higher thrust level) and the throttle command at 40 sec 
executes as desired. 

Not every engine control system has the same limits, but the 
general reaction across all of them will be similar when faced 
with engine ice accretion. The ice buildup causes a decrease in 
engine output (either fan speed or EPR) and so the fuel flow 
rate is increased to compensate. At some point the controller 
hits a maximum safety limit; in the case of C-MAPSS40k that 
is the core shaft speed limit, but in other cases it may be a 
maximum fuel flow rate limit (Ref. 10), temperature, or fan 
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Figure 7. — Engine and controller outputs for a 10 sec transition 
from 0 to 26 percent pressure drop across the LPC at cruise 
(25,000 ft, Mach 0.75, ISA+10) starting at f = 20 sec. Engine 
rollback occurs at approximately t = 30 sec, followed by a 
PLA burst from 68° to 80° at f = 40 sec with controller limits 
disabled (solid) and limits enabled (dotted). The dash-dot line 
on the core speed plot is the nominal core speed limit and 
the dash-dot line on the EPR plot is the EPR setpoint. 


speed. Once the limit is hit, the controller switches to a more 
conservative approach; for C-MAPSS40k this meant 
controlling to maintain maximum core speed, other cases may 
switch to an idle setpoint. 

While it is enticing to simply remove (or extend) the limits 
to prevent the rollback for occurring, this is not possible as the 
safety limits are actually being violated; changing the limits 
would expose the engine to excessive risk of failure. Thus 
after detecting the accretion of ice the engine operating state 
must change to avoid rollback while allowing for safe engine 
operation. If a precise knowledge of the health of the engine 
components is available then in some cases the limits can be 
extended while accepting minimal risk (Ref. 11), however 
these techniques are only in early developmental stages. 


6.0 Detection of Engine Icing 

Early detection of engine ice accretion is critical to enable 
the modification of engine operation to mitigate the impact of 
the icing and prevent rollback. As mentioned earlier, there are 
a limited number of engine sensors available for use in the 
detection process. C-MAPSS40k has ten sensors, more than 
typically found on a commercial aircraft engine. In 
C-MAPSS40k, each sensor is modeled as a first order system 
and zero-mean Gaussian white noise can be added. Adding 
typical noise (standard deviation of speed, pressure, and 
temperature sensors are 0.25, 0.50, and 0.75 percent of trim, 
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Figure 8. — Noisy sensor outputs for a nominal flight (blue) and 
a flight with engine icing (red) — 10 sec transition from 0 to 
26 percent pressure drop across the LPC at cruise 
(25,000 ft, Mach 0.75, ISA+10). 
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respectively) and comparing a case with no icing present to a 
case with a transition from no pressure drop at t = 20 sec to a 
26 percent pressure drop at t = 30 sec, the output of the full 
engine sensor suite is shown in Figure 8. This data indicates 
that a signature of engine icing in progress may be the increase 
in core speed and all temperatures while all inputs (P 2 , T 2 , and 
throttle) are level. 

Because the inlet pressure and temperature change with 
altitude and speed (as well as atmospheric disturbances), they 
will rarely be constant, it would be better to filter the data and 
then look at the first derivatives. Then a simple threshold can 
be applied to detect the accretion of engine ice. While this is a 
very simplistic approach, it serves as an effective baseline 
against which to compare other detection schemes. Figure 9 
shows an example of this detection approach during a 30 sec 
descent from 25,000 to 22,500 ft and Mach 0.75 to 0.72. In 
order to detect the buildup of icing, the derivative of P 2 , T 2 , 
and PLA must all be below their specified threshold while N c 
and T 5 o are above theirs. When this is true, the detection 
counter is incremented and when false, the counter is reset. 
Once the detection counter hits a limit then the event is 
flagged. In this example, the simulated icing begins at 20 sec 
and rollback occurs at 30 sec. Using the thresholds shown (red 
horizontal lines) the detection algorithm reaches the preset 
occurrence count 2.755 sec after the ice accretion begins 
(vertical red line). 
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Figure 9. — Detection of engine ice accretion using typical 
sensor suite during 30 sec descent from 25,000 ft, Mach 

0.75 to 22,500 ft, Mach 0.72. The data plotted is the 
derivative of the filtered sensor output. The horizontal red 
lines are detection thresholds. Detection occurs 2.755 sec 
after the onset of icing. 


In practice, this detection approach would have a number of 
problems but it is shown here to highlight the fact that using 
only the current engine sensor suite, the accretion of ice in the 
LPC has an identifiable signature that can be used in more 
complicated fault detection and classification systems 
(Ref. 12). 


7.0 Conclusions 

It has been found that using C-MAPSS40k, modeling a 
simple pressure drop across the low pressure compressor 
allows for the simulation of engine rollback due to engine 
icing. While this is not an ideal method for simulating the ice 
blockage it has been shown to produce behavior that is similar 
to that which results from using a compressor map that has 
been modified to include the effects of ice blockage. 
Simulations of engine rollback highlighted the fact that the 
engine rollback behavior is caused by the engine hitting 
maximum safety limits and the engine controller switching to 
a conservative control strategy. Removal of the limits has been 
shown to be effective at eliminating the engine rollback, but 
this is not a valid solution due to the increased risk of failure 
associated with removing (or increasing) the limits. The rapid 
detection of engine ice accretion should be possible using only 
the current sensor suite. To actually devise a detection method 
would require a greater understanding of the rate at which 
accretion occurs as well as the environmental conditions 


necessary for icing. Any detection scheme could be integrated 
with airframe mounted sensing devices to improve detection 
accuracy and speed. 

The work presented in this paper is in the initial stages. To 
enable future detection and mitigation work it is necessary to 
improve the modeling approach to use blocked compressor 
maps. Once the modeling work is completed, detection 
strategies will be refined and will need to be run against both 
normal and faulted non-iced engines to determine detection 
statistics. To enable the creation of mitigation strategies, it is 
necessary to have a better understanding of the conditions at 
which ice accretion is possible. Mitigation work will then 
focus on using the existing actuation to modify the engine 
operating point to one which prevents further accretion or 
which sheds the existing buildup. In the long term, a goal is to 
find engine control techniques that will allow the engine to 
operate in high ice water content conditions by preventing the 
accumulation of ice in the compressor. 
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